Is CVE-2026-35214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35214 being exploited in the wild.

How severe is CVE-2026-35214?

High severity, with a CVSS score of 8.7, published 3 April 2026.

Which products and versions are affected?

@budibase/server (npm) SEMVER:introduced=0,fixed=3.33.4.

Is there a fix for CVE-2026-35214?

Yes. @budibase/server (npm): upgrade to 3.33.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-35214 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-35214?

Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35214: Budibase path traversal in plugin upload endpoint

CVE-2026-35214 · Severity: high · CVSS 8.7 · Published 2026-04-03

Budibase's plugin upload feature accepts a user-supplied filename that is not validated for path traversal sequences, allowing authenticated Global Builders to escape the intended temporary directory and delete arbitrary files or write files to sensitive locations. An attacker could overwrite application code or system files, potentially causing service outages or (in containerized environments running as root) enabling code execution on application restart.

Technologies: @budibase/server (npm). Vendors: npm.

Quick answers

Is CVE-2026-35214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35214 being exploited in the wild.
How severe is CVE-2026-35214?: High severity, with a CVSS score of 8.7, published 3 April 2026.
Which products and versions are affected?: @budibase/server (npm) SEMVER:introduced=0,fixed=3.33.4.
Is there a fix for CVE-2026-35214?: Yes. @budibase/server (npm): upgrade to 3.33.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35214 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-35214?: Check whether you run @budibase/server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@budibase/server (npm): upgrade to 3.33.4 or later
```
npm install @budibase/server@3.33.4
```

Technical details

The POST /api/plugin/upload endpoint passes the user-supplied filename directly from the Content-Disposition header to createTempFolder() without sanitization, enabling path traversal via sequences like "../". The createTempFolder() function uses path.join() to resolve the filename against /tmp/.budibase, which does not prevent directory traversal, and then calls fs.rmSync() with recursive and force flags to delete any existing directory at that path, followed by fs.mkdirSync() and tarball extraction. An authenticated user with Global Builder privileges can craft a multipart upload with a malicious filename (e.g., "../../etc/target.tar.gz") to delete arbitrary directories and extract attacker-controlled tarball contents to arbitrary writable locations on the filesystem. The vulnerability was patched by sanitizing filenames, validating paths remain within the temp directory, and using fs.mkdtempSync() with random suffixes. Patches are available in version 3.33.4 and later.

Affected products

Budibase Budibase <3.33.4

Identifiers

CVE-2026-35214
GHSA-2wfh-rcwf-wh23

Timeline

2026-04-04: disclosed: Advisory published
2026-03-13: patched: Fix merged in PR #18240
2026-04-02: other: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.